Security awareness: Does your team know what to do?

Training is complete and the policy is published. But can an employee find the right contact for a suspicious message when the IT manager is unavailable?

Security awareness should lead to a usable action. Clear instructions, reachable reporting contacts and a short rehearsal help your team put knowledge into practice.

TL;DR: What to check this week

• Can employees find the relevant instruction and reporting route?
• Do they know what information a report should contain?
• Is there a reachable deputy and an alternative communication channel?
• Are identified gaps assigned an owner and a deadline?

As of 13 October 2026. The occasion is European Cybersecurity Month and ENISA's release of 30 September. The exercise below is our own worksheet. The cover is an AI-generated scene featuring Julian Köhn, not a photograph of a real training session.

Why completion alone is insufficient

ENISA reports that 74 percent of surveyed employees received suspicious emails, messages or links. Only 45 percent reported regular awareness updates from their organisation. These are survey responses: receiving a suspicious message does not establish a successful attack.

Our recommendation is to check usability alongside attendance. Employees need not investigate every technical detail. They should know how to report a concern safely and who takes responsibility afterwards.

Three questions before scheduling another course

Where is the instruction? A policy in an audit folder is hard to use. Make the relevant guidance accessible where employees normally work and name its owner.

Where does the report go? A specific contact is more useful than “tell IT”. Establish a deputy and an alternative route if the usual channel is unavailable.

What happens next? Employees should not have to perform a complete investigation. Specify who receives the report, requests clarification and decides the next steps.

A 20-minute exercise without deception

This tabletop exercise is a fictional example and our own recommendation, not an official ENISA template. It examines your procedure through discussion. It requires no live phishing emails, executable files or credentials.

Scenario: A message appears to be from a known supplier. It asks an employee to open an attachment and change payment details urgently. The employee is uncertain and wants to report it.

Time	Discuss together	Outcome
Minutes 0–5	What do we do while checking? Where is the relevant instruction?	Agreed handling of the concern
Minutes 5–10	Who receives the report? What information do they need?	Named contact and required details
Minutes 10–15	The first contact is unavailable. What happens next?	Deputy and alternative channel
Minutes 15–20	What failed? Who improves it, and by when?	Actions with owners and deadlines

Evaluate the procedure rather than ranking employees. If nobody can find the reporting route, that is an organisational improvement opportunity, not a reason to embarrass a participant.

Measure useful progress

Attendance tells you who completed training. Also record whether the team finds the correct contact, whether cover arrangements work and whether agreed improvements are completed.

Revisit those gaps in a later exercise. This creates a traceable improvement cycle. The exercise alone does not establish certification or full regulatory compliance.

Connect policies, people and actions

Kopexa connects policies, the Workforce Hub and tasks: provide relevant content, track training and policy evidence, and assign improvements to responsible people. The Workforce Hub gives employees access to relevant content and contacts.

Your team still facilitates the tabletop discussion. Kopexa supports organisation and evidence; this is not a claim of automated phishing simulation.

If the work is spread across a wiki, email and spreadsheets, explore our ISMS software. Bring a reporting procedure to the demo so we can discuss a concrete workflow.